CVE-2026-72334 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: fix malformed ISO_END/CONT handling
Core specification (Part C vol 4 sec 5.4.5) does not exclude empty ISO_CONT, ISO_END packets. We currently reject them if they are last.
If controller sends malformed sequence
ISO_START -> rx_len = 4, ISO_CONT skb->len 4, ISO_START
that ends payload in ISO_CONT, we leak conn->rx_skb. If controller sends too long ISO_END, we panic on skb_put. If controller sends too short ISO_END we accept it.
Fix by marking unfinished ISO_START via conn->rx_skb != NULL. Check skb->len properly before skb_put. Combine the ISO_CONT/END code paths as they require the same initial checks. Reject too short ISO_END packets.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability resides within the Linux kernel's Bluetooth implementation, specifically affecting the Isochronous (ISO) channel handling mechanism. The flaw manifests in how the kernel processes malformed ISO_END and ISO_CONT packets during Bluetooth audio streaming operations, creating potential security risks through memory corruption and system instability. The issue stems from improper validation of packet sequences that occur when Bluetooth controllers transmit malformed data streams, particularly in scenarios involving ISO_START, ISO_CONT, and ISO_END packet transitions.
The technical root cause involves the kernel's failure to properly validate packet lengths and sequence integrity during ISO channel processing. When a controller sends a malformed sequence beginning with ISO_START followed by an ISO_CONT packet with rx_len = 4 and skb->len = 4, then another ISO_START packet, the system leaks memory through conn->rx_skb not being properly managed. Additionally, when controllers send overly long ISO_END packets, the kernel panics due to improper buffer handling in skb_put operations. Conversely, when controllers send insufficiently long ISO_END packets, the system accepts them without proper validation, creating potential data corruption scenarios.
The vulnerability impacts the Bluetooth subsystem's reliability and security posture by enabling memory leaks that can lead to resource exhaustion and potential privilege escalation pathways. This flaw directly relates to CWE-129 Improper Validation of Array Index and CWE-787 Out-of-bounds Write, as the kernel fails to properly validate packet boundaries before memory operations. The operational impact includes system instability through kernel panics, memory corruption through improper skb handling, and potential denial of service conditions that could affect Bluetooth audio streaming capabilities.
The fix implements proper state tracking by using conn->rx_skb != NULL to mark unfinished ISO_START sequences, ensuring correct memory management throughout the packet processing lifecycle. The solution addresses buffer overflow risks by implementing proper skb->len validation before calling skb_put operations, preventing both kernel panics and memory corruption. Additionally, the code paths for ISO_CONT and ISO_END handling are consolidated to reduce code duplication while maintaining identical validation checks, which aligns with ATT&CK technique T1059.008 for kernel-level exploit development prevention.
This vulnerability demonstrates the critical importance of proper input validation in kernel-space Bluetooth implementations, particularly when handling streaming protocols where malformed packets could originate from compromised or misconfigured devices. The fix ensures that all ISO_END packets are properly validated against minimum length requirements, preventing both immediate system crashes and potential long-term memory corruption issues. The implementation follows security best practices by establishing clear state management for incomplete packet sequences and implementing robust buffer boundary checking that prevents unauthorized memory access patterns.
The mitigation approach addresses multiple attack vectors simultaneously by ensuring proper sequence tracking, buffer validation, and code consolidation. This comprehensive fix reduces the attack surface for Bluetooth-based exploits while maintaining backward compatibility with legitimate ISO channel operations. The solution also aligns with security frameworks requiring proper resource management in kernel modules, as evidenced by the prevention of memory leaks through proper connection state handling and the elimination of potential privilege escalation paths through buffer overflow protection mechanisms.